Security for the rest of us.
Detection, investigation and response to cyber incidents for companies that need it most. Run by specialists who investigate real cyberattacks and know how to get the attackers out of your network.
Most cyber attacks don't look like an attack until it's too late.
By the time a breach gets loud, you are watching the last step. Files encrypted, your data for sale on the darkweb, a payment made to an untraceable account nobody recognises. Everything before it happened quietly, and it often follows three stages.
- I
Initial Access
Often without exploiting anything particularly sophisticated. A weak password, a convincing phishing email, or a server that nobody remembered to patch.
- II
Discovery and Lateral Movement
Once in, the attackers explore the network, identify accounts with elevated privileges, and look for valuable data. Often using the same tools your IT team relies on every day.
- III
Impact
Files encrypted, data stolen, payments redirected. For most businesses this is the first part anyone notices. By then the attacker may have been inside for days or weeks.
An intrusion can unfold in a matter of hours or go unnoticed for months. How long it takes the attacker to succeed depends on who's behind the attack, how sophisticated they are and how well your environment is protected.
“But we have antivirus.”
Antivirus works when an attacker brings malware. That used to be the norm. These days they often don't need to: they sign in with a stolen password, use a remote-access tool your team already trusts, or run scripts through the interpreters Windows ships with by default. There's no virus to find. Nothing on disk looks suspicious, because nothing on disk is theirs.
That's the gap Duntze Security fills. Modern Endpoint Detection and Response (EDR) looks at what is happening across your systems, not just which files are present. It gives us a chance to catch an intruder while they are still moving through your environment, rather than after they have encrypted everything and left a ransom note.
How Duntze Security helps.
MDR
Managed Detection and Response →
We watch your environment around the clock so an intrusion surfaces while there's still time to do something about it. Endpoints, the accounts people log in with, and the cloud services your business depends on.
DFIR
Digital Forensics and Incident Response →
Something has already gone wrong and you need answers. We establish what happened, contain the threat, work out what was affected and help you regain control of your systems.
Managed Detection and Response (MDR).
The ongoing service. We monitor your environment continuously and respond to suspicious activity before it turns into a bigger problem.
Detect
An unusual login. A service account that suddenly asks for administrator rights. A machine talking to infrastructure it has never contacted before. Those are the things that give an intruder away, and they only show up if someone knows how to spot that behavior. Our analysts have spent years investigating real attacks, so they know which of them deserve a closer look.
Investigate
An alert is only the starting point. We look at the activity around it, gather the relevant evidence and establish whether we are looking at harmless behaviour or an actual intrusion. When a case needs to go deeper, our GIAC-certified forensics analysts can work through memory, process history, persistence mechanisms and authentication records. You don't have to sort through alerts or decide what matters. That's our job.
Respond
If an attacker got in, we cut off their access, remove what they left behind and work to get your systems back to normal. Affected machines can be isolated from the network within minutes when containment is the right call. Once it's over you get a report explaining what happened and what to fix so the same door doesn't work twice.
Tooling and coverage. We work with established endpoint detection and response platforms, including CrowdStrike. If you already have a platform that gives us the telemetry we need, we'll assess whether we can work with it rather than sell you a replacement. Coverage can extend across endpoints, identity and cloud, depending on your environment and what you need protected. We agree on the scope before anything is deployed.
Response times we stand behind
These are acknowledgement times: how long before an analyst has the alert open and is actively working on it. They are not automated email notifications, nor a promise that an incident will be contained within that window.
We also offer a lighter business-hours tier for smaller environments. Critical and high-severity alerts are still picked up within four hours. Ask us what fits.
Digital Forensics and Incident Response (DFIR).
Whether you're dealing with ransomware, a compromised account or a fraudulent payment, the first priority is understanding what happened. We investigate how the attacker gained access, which systems and data were affected, and whether they still have access to your environment. Our findings are based on the available evidence, and we'll be clear about anything we cannot establish. You don't need to be an existing monitoring client to engage us.
IStop the bleeding
We start by stopping any ongoing malicious activity. This can involve disabling compromised accounts, revoking active sessions and isolating affected machines. We coordinate containment with your IT team to limit disruption while preventing the attacker from continuing their activity.
IIFind how they got in
We look for evidence of how the attacker entered your environment. This could be a compromised account, an exposed service or a malicious attachment. We also investigate whether the attacker established persistence or left other ways to regain access. Identifying the initial access point isn't always possible, particularly when logs are missing or evidence has been destroyed. We are transparent about what we found and what remains uncertain.
IIIEstablish what was reached
We examine the affected systems and accounts to establish what the attacker did after gaining access. This includes looking for privilege escalation, lateral movement, data access and possible exfiltration. The objective is to establish which parts of your environment were affected and whether there is evidence of data being accessed or stolen.
IVDocument the findings
At the end of the investigation, we provide a report detailing the incident, our findings, the evidence supporting them and the actions taken during the response. The report also includes recommendations for addressing the entrypoint that allowed the incident to happen and reducing the risk of another compromise.
In the middle of an incident? Get in touch as soon as possible. The sooner we can investigate, the better our chances of containing the damage.
Get help now →People make the decisions. Software does the legwork.
Security tools collect and organise information at a speed no analyst could match by hand. They bring together the context around an alert, gather evidence and handle repetitive tasks. This gives our analysts more time to investigate and make decisions.
But context matters. An unusual login might be an attacker, or an administrator working late. A process that looks suspicious on one machine might be perfectly normal on another. Knowing the difference takes someone who understands the environment and can interpret the evidence.
What the tooling does
- Correlates events around an alert
- Looks up the files, domains and accounts involved
- Collects the forensic evidence off the affected machine
- Cuts a machine off the network when seconds matter
What a person decides
- Whether an alert points to an actual attack
- How far the attacker got
- Which accounts or systems need to be contained
- When the investigation is complete and what needs to happen next
Every case is reviewed by an analyst who takes responsibility for the investigation and its outcome. Tools help us work faster, but the decisions remain with the people doing the work.
Why companies rely on us.
- ≤ 30 min
- Critical and high-severity alerts acknowledged, day or night
- 24/7/365
- Monitored, with threat hunting running alongside the alerting
- 0
- First-tier queues between your alert and a senior analyst
Expertise you'd normally have to fly in.
We hold the GIAC GCFA and GSOC certifications, with professional experience in digital forensics, detection engineering and security operations. Our work previously included securing private banks and critical infrastructure in Europe, as well as airlines and healthcare providers across Latin America.
The people watching are the people investigating.
Many security services rely on large teams of junior analysts working through alerts at volume. We take a different approach. Your environment is monitored only by experienced practitioners who have several years of experience in responding to cyber incidents and recognise immediately when something is off. The same people stay involved when an alert turns into an incident.
Built around your business, not an enterprise price tag.
You shouldn't need an enterprise budget to have experienced incident responders monitoring your environment. We scope our services around what you actually run, with clear pricing and no unnecessary seat minimums.
Swiss excellence. Local commitment.
Duntze Security was founded to bring the experience and working standards developed in Switzerland to businesses in Panama. We understand the local business environment and want to make the level of cybersecurity expertise found in established international markets accessible here.
Notes from the field.
Technical write-ups from real incidents, investigations and our own research. How attacks actually work, what to look for, and what we learn from investigating them.
When the EDR runs out of road: memory forensics for 400 SOC analysts
On 21 October we taught memory forensics at the Comunidad DOJO SOC Level 2 bootcamp. The case we walked through: a process-injection alert where the EDR could prove something was injected, but not what.
Sep 2026INC Ransom in Panama: how the group behind the Metales Panamericanos attack operates
The INC Ransom gang listed Metales Panamericanos on its leak site. How the group operates, and what a Panamanian SMB can do to cut its risk.
Jul 2026SVG smuggling: an infostealer disguised as a court summons
An .svg file with embedded JavaScript kicked off a social-engineering chain ending in a downloaded infostealer. No macro, no exploit, just a file type nobody expects to run code.
Tell us what you're protecting.
A short introductory call is enough to understand your environment, what you're looking for and how we can help.
contact@duntzesecurity.com